GHSA-v7r8-8p5c-h4xw
XWiki AdminTools application doesn't set permissions on the AdminTools space
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.xwiki.admintools:application-admintools | < 1.1 | 1.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Users without admin rights have access to `AdminTools.SpammedPages`.
### Details
View rights are not restricted only to admin users for `AdminTools.SpammedPages`. While no data is visible to non admin users, the page is still accessible.
### Workarounds
Set the view rights for the `AdminTools` space to be only available for the `XWikiAdminGroup`.
References
External links from the advisory. They lead to third-party sites.